Posted
by
Soulskill
on Friday June 15, 2012 @11:30AM
from the clippy-was-a-double-agent dept.

Barence writes "U.S. government officials could be working under cover at Microsoft to help the country's cyber-espionage programme, according to one leading security expert. According to Mikko Hypponen, chief research officer at security firm F-Secure, the claim is a logical conclusion to a series of recent discoveries and disclosures linking the U.S. government to 2010's Stuxnet attack on Iran and ties between Stuxnet and the recent Flame attack. 'It's plausible that if there is an operation under way and being run by a U.S. intelligence agency it would make perfect sense for them to plant moles inside Microsoft to assist in pulling it off, just as they would in any other undercover operation,' he said. 'It's not certain, but it would be common sense to expect they would do that.'"

I dunno about that.....of late, the Obama administration is been quite 'leaky' when it comes to secret/covert ops.....what we already know about Stuxnet comes to mind.

I'm not so sure knowing about stuxnet is really a leak. I seem to remember, when Iran started complaining about it, that pretty much everyone thought it was the US/Israel.

It really didn't appear to be anyone else, and it didn't appear like anyone else would really care - so confirming it was the US/Israel was about as revealing as someone telling me that it's possible the US might have invaded Iraq for oil-related reasons

"For the past year, we sent a Google developer deep undercover at Microsoft armed with an Android-powered hidden camera and an agenda to subtly promote open technologies. Now, we're going to show you the results. Sometimes hilarious, sometimes heartbreaking, sometimes horrifying; tune in starting this August on Slashdot TV for 'Moles in Microsoft' to see what happens when development ideologies collide in the real world."

Or they just paid former microsoft employees with technical positions to come work for the government.

Didn't the NSA offer to help 'secure' windows 7 (http://www.computerworld.com/s/article/9141105/NSA_helped_with_Windows_7_development), they could just offer to help with 'collaboration' and then provide some security fixes and use some of the loopholes they find before anyone else does.

Now the israeli's. They have spies at microsoft. The US government probably not directly, at least not in the US, there are enough cheaper no risk ways to get what they want.

I'm not even sure they would have to do that. The technical details in TFA are a bit scarce, but enough exists for a better theory than the TFA presents.

Someone with some hefty CPU power broke the MS cert, which allowed them to create their own at will and spoof a MS cert.

The Government has the access to MS source code, and their methods. If you know where hooks get applied and how priorities work, you don't need to be from MS to write good code. You just need to be a good coder.

Spoofing Windows Update server really would not be that hard. Hell you don't even need a real man in the middle attack if you have a forged Cert and know the structure. You just need to spoof a DNS answer, the client will do everything else for you.

Having the fake key is huge! Write an application, sign as Genuine MS, put on a faked Windows update server, reroute a DNS call. Shazam! Of course there is other knowledge required, such as evading AV detection, etc.. but they had that figured out very well also.

It would take a good team, and time, but no need to have a mole. I would not be surprised if the US Government had moles in MS, but if they did it would primarily be for reasons other than Stuxnet and Flame, or any other computer espionage program.

It would take a good team, and time, but no need to have a mole. I would not be surprised if the US Government had moles in MS, but if they did it would primarily be for reasons other than Stuxnet and Flame, or any other computer espionage program.

I would be surprised if the US doesn't have "spies" within Microsoft. Microsoft is huge, and hugely important in how the world handles data. I would be shocked if the US, China, India, Russia, and several other countries didn't have "spies" somewhere in Microsoft.

You agreed with what I said about them possibly having spies, but no other input. Do you really think they would be there to infect the OS and devise espionage schemes? I found that extremely unlikely. More like, they are making sure certain things don't get fixed, and making sure that the good people at Microsoft don't behave in corrupt ways that they are not known to act (Corrupt for the US is good, corrupt for China not so much). Maybe watching to make sure foreign influences don't hack espionage in

If you are sufficiently concerned about it, then you can inspect the sourcecode of linux and/or remove the parts you don't want...You can't do that with windows.

If you're a national government, then you certainly have the resources to inspect linux, and you'd be foolish not to inspect the software you use for critical infrastructure.

Even if you can't or won't inspect the linux source, you at least gain some assurance from the fact that many independent people with differing goals are able to see the source. Again, this is something windows simply doesn't provide.

Quite honestly I have no idea what argument you were making. You don't seem to have made an argument. You had a some random gibberish and a link about a secure version of linux, which has nothing to do with what I was saying.

I wasn't alluding to anything. I said clearly that MS handed over everything to the NSA, and that the government can easily hire former MS employees. There's no secret that that would give them basically full access to windows. What they do with linux is a separate matter.

Little known secret about Gitmo: Terrorists voluntarily spill the beans after they're forced to analyze the Windows source code for exploits. Everybody's led to believe it's waterboarding, but that's actually the lesser evil. There's a reason they don't send drones out for the engineers-turned-terrorists.

Not to belabor the obvious. This is one reason open source, over time, is more secure that closed source. Which would you rather rely on, software that has source code anybody can look at, or software that only the development company and the military of the world's sole superpower can look at?

Of course, nefarious elements can put subtle security bugs in open source projects, but one hopes over time that the community is able to find and eliminate them.

Another clear advantage to open source is that it is easy to obtain the source code from multiple different routes and run comparison checks, thus assuring that the source code you have is in fact the code everyone is using. If you are buying copies of closed source code on the black market, you have no assurance that the code is correct in all respects, and no way to assure that the seller is not an agent of the CIA, Mossad, MI5, or the French Foreign Legion.

The problem with the claim put forward in the article is that it is *not* the logical conclusion of what we know about Stuxnet and Flame. What we know about Flame is that (i) it's the most advanced piece of malware ever created (that we know about), (ii) it has connections to Stuxnet, (iii) it's primarily targeting Iran, but it's also targeting Syria, Palestine, Egypt, Saudi Arabia. That information tells us a lot about who was behind it.

Okay, so first off, Flame is very large and extremely advanced. That implies a country with an advanced cyber-warfare program. That list is fairly short, and the big names on it are the United States, Russia, China, and Israel.

Second, the people behind Flame were also involved in Stuxnet. The people analyzing Stuxnet came to the conclusion that it was the work of two different countries, with suspicion falling on the U.S. and Israel. In the New York Times article, it's reported that Stuxnet is designed by the U.S., but the Israelis helped out. The Obama Administration has not denied anything published in that article.

Third, Flame is primarily targeting Iran, again that points to the U.S. and Israel, Iran's primary enemies. However, Flame's secondary targets are all areas that are potential threats to Israel (Syria, Palestine, Egypt, Saudi Arabia) but this list does not include countries that pose security threats to the U.S. but not to Israel (Afghanistan, Iraq, North Korea). Finally, there are also some Flame infections in Israel itself. Given that one of the purposes of an intelligence organization is (unfortunately) to spy on their own citizens, that also fits the idea that Flame is written by the Israelis.

If Flame is Israeli, then the idea that the U.S. is planting spies in Microsoft is not the "logical conclusion" of the facts at all. So does this mean that the Mossad has penetrated Microsoft? Well, I suppose it's possible. It would antagonize the U.S. to learn that our ally has spies in our corporations, but it's also been alleged that Israel has moles in the Pentagon, so it wouldn't be entirely surprising, either.

Neither GCC or the Linux kernel are products of "individuals/small foundations". Both GCC and the Linux kernel have tons of money behind them, with contributions by paid developers from large corporations like IBM, Oracle, HP, Intel, etc.. Red Hat also employs a number of kernel and GCC developers, and they certainly are not small. In fact, very little in GCC or the kernel is done by any non-paid developers.

The thing is, the complexity of software like Flame pretty much guarantees someone was paid to writ

Or they just have smart enough people that can figure out how Windows works without actually having to be an employee. Much simpler too to just have a cheap summer hire save up all the source code on a thumb drive.

Because in a casual conversation like a forum post, grammar Nazis add nothing to the actual conversation. It is usually a small mind that cant find anything else to say, so they hunt for grammar errors.

Check the fine print at the bottom of the page: "CVE is co-sponsored by the National Cyber Security Division of the U.S. Department of Homeland Security."

So that means the government doesn't even need to go looking for holes - security companies send them to the government directly to be listed!

No mole required, just a "friendly" email informing them that they're going to keep silent for a bit and "forgetting" to post the alert publicly.

CVE doesn't work that way. From the FAQ:

Isn’t CVE just another vulnerability database?

No. CVE is not a vulnerability database. CVE is designed to allow vulnerability databases and other capabilities to be linked together, and to facilitate the comparison of security tools and services. As such, CVE does not contain information such as risk, impact, fix information, or detailed technical information. CVE only contains the standard identifier number with status indicator, a brief description, and references to related vulnerability reports and advisories.

The project arose because different vendors were assigning different names and ids to vulnerabilities and generally just confusing the hell out of everyone. CVE just provides a standard id that all of the different security researchers can use to refer to the same issue.

In practice, researchers typically contact MITRE or other software vendors participating in the program to obtain a CVE ID, possibly before the assessment of the vulnerability is complete. Then they

I doubt Microsoft would balk at any requests at access. These are, after all, matters of national security, and are therefore paramount over all other concerns. No decent American (ahem) company could refuse.

They THINK there MIGHT be moles inside Microsoft. ("Definitive proof!" says Alex on his radio show.) That's nice. I think their might be moles inside everybody's backyards..... I haven't actually seen any, but let's publish it anyway and scare everyone.

1. Publish some random guy2. Spin it to make it sound factual "evidence"3. $profit$

But Beck usually backs-up his stuff with documents. Quoting Bill Ayers or Cloward-Piven from the 70s saying, "We will blow-up government buildings and take over through force," is pretty damning. Quoting the FBI Agent who infiltrated the organization and confirms they were prepared to kill to achieve their ends is also pretty damning.

But that is how conspiracies work. The more information you don't have the stronger the evidence that it must be real.I mean a while back they took a mixed race baby born in a different country, paid the hospital to lie to publish a new paper reports, and an other insider generated false documents to prove he was born in the United States, Pay for a team of actors to say they knew this child when they were children, all in the offshoot that perhaps this child (where the culture at the time figured had near

But that is how conspiracies work. The more information you don't have the stronger the evidence that it must be real.
I mean a while back they took a mixed race baby born in a different country, paid the hospital to lie to publish a new paper reports, and an other insider generated false documents to prove he was born in the United States, Pay for a team of actors to say they knew this child when they were children, all in the offshoot that perhaps this child (where the culture at the time figured had near 0 chance of major success in life) would become president and support the Socialist Cause....

Yea, and the moon landings where faked too.... Seriously, there are just some things that do not make sense to keep beating and this whole birther thing is a long dead horse, as is the idea that the moon landings were faked or 9/11 was an inside job. Besides, there are more effective arguments you can use to use that don't involve wild conspiracies where you have to suspend all reason.

It's usually better to not think of things as conspiracies anyway. Folks are usually not that good at cooking up such com

Are you sure? Hell if I had a few trillion dollars like some of them guys and no real job, I'd probably sit around scheming all day. I have morals, so doubt my scheming would be in the same lines as theirs, but still..

And you do realize that many of those theories came out to be correct right? Such is the nature of conspiracies, if theories are correct then they show themselves. Search for TCP ACK, Tread milling applications, and monopoly for a start. Then compare many of those posts to the US vs. MS, Iowa vs. MS, Novel vs. MS, etc.. etc...

Of course there is always some chatting and opinion tossing in threads as well, but that is the nature of any forum. It's very odd that a company that people talking about a compan

Wow, must be way passed my bed time. '''It's very odd that a company that people talking about a company that has been found guilty of illegal monopolistic practices is considered FUD by you. Do you have any idea how many times they have been found guilty? ''' haha, sorry. Let me try that again with English

It's very odd that you believe it's FUD when people talk poorly of MS. They have been found guilty of abusing their monopoly power many many times. Any guess at how many times? It is a large number,

Every major government around the world ALREADY has access to Windows source code. Starting in 2001, when Microsoft's security started being a major focus, they began a program to grant access to the code to interested parties.

Make an obvious show of force, and fifty people know about it. When one of them talks, you have no idea who spilled the beans, and in fact, you really can't tell if anyone did or if it's an outsider just speculating that you leaned on Microsoft. The quietest way is to plan in advance. Find a young guy in your agency who has what it takes to become just the right employee in the right position a few years down the road, and pay him* to get really good at what you think Microsoft will want by then. The second

You don't need a big gun to get the MS source code. It isn't some big fucking secret like all the./ers seem to think. It isn't GPL, but plenty of institutions have copies. Basically any government that uses Windows does, huge surprise there. Also a lot of research universities. One such university I know that has it is ASU. Then there are copies in the hands of partners for better debugging/integration of their products.

I know you're new around here, but please, everybody else has known for years and years that the US Government already has a license to MS source code. Even countries like India have that license. What is in the source isn't secret, and the files have even been broadly published for example on torrent networks. It is highly restricted, but not unknown or unknownable.

And in the general case, any company that is providing software for use in the most secure military installations gave access to their code yea

Let's not beat around the bush! I say Microsoft has known USG agents working on the systems intentionally putting holes in the OS that can then be leveraged for zero-day attacks against other governments. Balmer is in cahoots I say! CAHOOTS!

I think it is a matter of time before US media is banned from reporting on the findings by computer security experts - especially the uncontrollable ones in Russia and Finland - under the guise that it aides and abets terrerists.

If it's truly beneficial to have moles in software companies, you can expect that China and maybe Russia also have them too.. The only benefit seems to be the certificates and access the update servers.

Read more about what actually happened. Microsoft was using some keys with md5 hashing that weren't properly set to prohibit their use for code signing and those keys were signed by the Microsoft root. Using a collision attack they created a copy of a signed key and used that to sign their code.

They're not exclusive and the government doesn't trust Microsoft either. Sure, pretend to partner with Microsoft and put in some explicit backdoors. Just make sure that there are a few Microsoft doesn't know about too.

1. DUH
2. "May have". Yeah, that's news. Meaningless. They "may not have" too. Is there something specific somebody has to say, with something to back it up other than a closed circle of "may have"?
3. Speculation is fact on Slashdot. This warrants an article, why? Is there NEWS here, or are we going to see "space aliens MAY HAVE dressed up like call-boys and 'anally probed' the editorial staff"?

You know, when the discovery of an driving game in Excel 2000 was the earth-shattering revelation of the year. The current crop of hidden "features" kind a gives new meaning to the term "Easter egg", no?
Oh, and get off my lawn...

... Microsoft's antitrust agreement with the DOJ [wikipedia.org] was overseen by the presiding judge of the FISA [wikipedia.org] court? My guess is that they needed to limit the amount of information concerning Windows inner workings being released to third parties where such inner workings were critical to intelligence gathering functions. Who other than a FISA court judge would be cleared to have the FBI/CIA/NSA call up and tell them to leave out details of certain interfaces?

Having access to Microsoft's signing certs for updates and drivers would be a huge help. I imagine the US government has some involvement - even if they don't want the certs themselves, they also don't want an employee with access forced to leak them after agents for China/Iran/Other kidnap and threaten to murder his daughter. So it's in the best interests of the US to at the very least ensure Microsoft's internal security team is doing their job.

Imagine a government with access to a complex OS source code. Then imagine that they get data on all manner of security holes as they are discovered. Imagine also that this government has access to OS security update certifications. Finally, imagine that this same government has the ability to hack into server DNS tables to route targeted users to their alternative 'security updates'.

The penetration of any software company by undercover government operatives would hardly be surprising, but entirely unnecessary. Microsoft would hardly be alone as a target of such espionage -- every software company would be vulnerable, including OSS. There is also the issue with 'backdoors' hard-wired into computer hardware, including especially telecom systems. IIRC, this became an issue recently with news of backdoors alleged to exist in VLSI circuits manufactured in China. Older news alleged that Israel also puts backdoors into the telecom hardware they sell & ship, including to the USA government.

If virtually every government does such spying, including upon their own citizens, and any number of software & hardware companies do the same with their customers, any cautious user of such technology should be aware of the potential security breaches they expose themselves to every time they connect to the internet, or open their front door for that matter. Redundancy & breadth of security beats security through obscurity any day.

The phrases of the day are, "Trust no one", "Security in depth", and "If it can't be accessed remotely, it's more secure & less vulnerable". At that point, physical security & Tempest-hardening secure your valuable data. The rhetorical question is, "How valuable is your data if you cannot readily access it?" I found it humorous that the USA government recently wanted reporters to write their news stories on government-supplied computers, if only to avoid unwanted data leaks & stop potential whistleblowers in their tracks.

Trust the USA government, or any government, or any corporation with an agenda? Why take that risk unmitigated? And who in Hades would put vulnerable sensitive SCADA systems in close proximity to the Internet except an idiot?

Hmmmm.... I close my eyes and imagine that.... Um.. Not much help to me without the necessary tools to build said source into something and perhaps some documentation that explains how stuff is supposed to work... Oh, Well I suppose you could eventually figure out what tools you needed though trial and error, then developed your own documentation on the internal workings of Microsoft's code.. But make no mistake, it's NOT going to be an easy task to work through enough of this to even attempt to use the k

Besides, it would be MUCH easier and cheaper to co-opt some hardware vendor's driver set and slip your stuff into that than risk doing the same at Microsoft.. Not that I'm saying it didn't happen, only that it seems easier other ways.....

I agree. And there have been documented cases of this being done. One of the most famous was the worm installed in firmware of a printer shipped to Iraq that incapacitated big chunks of Saddam's air defense system, courtesy of the NSA.And again regarding hardware: I wonder how many add-in PC cards like video or network that have back-doors built-in, or even hidden 'features' built into the firmware. I just threw out a serial/parallel ISA board so old that it was all TTL logic, no VLSI, no firmware.

I don't see how working at microsoft would give you any advantage at making Stuxnet or Flame. It's not like Microsoft put secret holes in their OS so people in MS can access everyone's computer. Probably my mom wrote that article.

Indeed, it was inside information from Siemens that was used in Stuxnet, and Siemens cooperated fully and completely.

Please, don't be shy Anonymous Coward. I believe that you are onto something there.

When conspiracy theories ultimately are discovered to be conspiracy fact, the mainstream media will dismiss it as 'common sense everyone knew', 'nothing to see here', and then put the sheeple back to sleep. Causality doesn't equate to coincidence. Anyway, I don't believe that any chain of statistically improbable events conflates to mere coincidence. Mere coincidence is highly over-rated. It is stated, with some degree o

What matters, is that you can see and inspect their contributions, or even remove them if you want.

Sure, you may not have the skills, resources or desire to inspect the code, but governments certainly do, and certainly should for anything remotely important. Plus for an organisation the size of a national government, inspecting sourcecode once and then using it widely isn't even all that much of an overhead.

Wrong with your first statement, the majority of the worlds data is on Unix or Unix like systems. Desktop files (.doc,.xls, etc..) are an extremely small portion of the worlds data. The rest of your statement is agreeable.